From 15e3973ac2c5eb639b85277912eddfcc3245df59 Mon Sep 17 00:00:00 2001
From: Ingo Paschke <ipaschke@lpclabs.de>
Date: Tue, 12 May 2026 15:24:15 +0200
Subject: [PATCH] Amiga: tighten input/dialog buffer bounds

Right-size the Intuition string-gadget buffer to BUFSZ so a caller
with a BUFSZ-sized buffer cannot be overflowed.  Enlarge the
amii_yn_function prompt buffer to fit the worst-case query + resp
+ def + trailing space and switch the appends to Snprintf with
remaining-space tracking.  Replace sprintf in amii_display_file's
"Can't display X: Y" path with Snprintf.  In EditColor's Save path
drop the strcpy/strcat chain that could trail off the end of
oname/nname when dirname returned a near-full path; use Snprintf
instead.  Rewrite dirname() to copy first and truncate the copy,
so it no longer briefly NULs the caller's string.
---
 sys/amiga/winami.c | 15 +++++++++------
 sys/amiga/winreq.c | 48 +++++++++++++++++++++++++++-------------------
 2 files changed, 37 insertions(+), 26 deletions(-)

diff --git a/sys/amiga/winami.c b/sys/amiga/winami.c
index edd1b5d15..6fdd95b55 100644
--- a/sys/amiga/winami.c
+++ b/sys/amiga/winami.c
@@ -339,7 +339,7 @@ struct NewScreen NewHackScreen = { 0, 0, WIDTH, SCREENHEIGHT, 3, 0,
 void
 amii_askname(void)
 {
-    char plnametmp[300]; /* From winreq.c: sizeof(StrStringSIBuff) */
+    char plnametmp[BUFSZ]; /* matches StrStringSIBuff in winreq.c */
     *plnametmp = 0;
     do {
         amii_getlin("Who are you?", plnametmp);
@@ -577,7 +577,7 @@ amii_yn_function(const char *query, const char *resp, char def)
     char q;
     char rtmp[40];
     boolean digit_ok, allow_num;
-    char prompt[BUFSZ];
+    char prompt[BUFSZ + QBUFSZ + 16];
     struct amii_WinDesc *cw;
 
     if (cw = amii_wins[WIN_MESSAGE])
@@ -592,10 +592,12 @@ amii_yn_function(const char *query, const char *resp, char def)
             *rb = '\0';
         (void) strncpy(prompt, query, QBUFSZ - 1);
         prompt[QBUFSZ - 1] = '\0';
-        Sprintf(eos(prompt), " [%s]", respbuf);
+        Snprintf(eos(prompt), sizeof prompt - strlen(prompt),
+                 " [%s]", respbuf);
         if (def)
-            Sprintf(eos(prompt), " (%c)", def);
-        Strcat(prompt, " ");
+            Snprintf(eos(prompt), sizeof prompt - strlen(prompt),
+                     " (%c)", def);
+        Snprintf(eos(prompt), sizeof prompt - strlen(prompt), " ");
         pline("%s", prompt);
     } else {
         amii_putstr(WIN_MESSAGE, 0, query);
@@ -705,7 +707,8 @@ amii_display_file(const char *fn, boolean complain)
 
     if ((fp = dlb_fopen(fn, RDTMODE)) == (dlb *) NULL) {
         if (complain) {
-            sprintf(buf, "Can't display %s: %s", fn, strerror(errno));
+            Snprintf(buf, sizeof buf,
+                     "Can't display %s: %s", fn, strerror(errno));
             amii_addtopl(buf);
         }
         return;
diff --git a/sys/amiga/winreq.c b/sys/amiga/winreq.c
index d4a1bc362..fb87db8bc 100644
--- a/sys/amiga/winreq.c
+++ b/sys/amiga/winreq.c
@@ -21,8 +21,8 @@ struct IntuiText IText1 = { 3, 0, JAM1, 4, 1, NULL, (UBYTE *) "Cancel",
 struct Gadget Gadget2 = { NULL, 9, 15, 56, 10, NULL, RELVERIFY, BOOLGADGET,
                           (APTR) &Border1, NULL, &IText1, NULL, NULL, 1,
                           NULL };
-UBYTE StrStringSIBuff[300];
-struct StringInfo StrStringSInfo = { StrStringSIBuff, UNDOBUFFER, 0, 300, 0,
+UBYTE StrStringSIBuff[BUFSZ];
+struct StringInfo StrStringSInfo = { StrStringSIBuff, UNDOBUFFER, 0, BUFSZ, 0,
                                      0, 0, 0, 0, 0, 0, 0, NULL };
 SHORT BorderVectors2[] = { 0, 0, 439, 0, 439, 11, 0, 11, 0, 0 };
 struct Border Border2 = { -1, -1, 3, 0, JAM1, 5, BorderVectors2, NULL };
@@ -187,14 +187,23 @@ EditColor(void)
                         break;
                     }
 
-                    strcpy(oname, dirname((char *) configfile));
-                    if (oname[strlen(oname) - 1] != ':') {
-                        sprintf(nname, "%s/New_NetHack.cnf", oname);
-                        strcat(oname, "/");
-                        strcat(oname, "Old_NetHack.cnf");
-                    } else {
-                        sprintf(nname, "%sNew_NetHack.cnf", oname);
-                        strcat(oname, "Old_NetHack.cnf");
+                    {
+                        size_t olen;
+                        strncpy(oname, dirname((char *) configfile),
+                                sizeof(oname) - 1);
+                        oname[sizeof(oname) - 1] = '\0';
+                        olen = strlen(oname);
+                        if (olen > 0 && oname[olen - 1] != ':') {
+                            Snprintf(nname, sizeof nname,
+                                     "%s/New_NetHack.cnf", oname);
+                            Snprintf(oname + olen, sizeof(oname) - olen,
+                                     "/Old_NetHack.cnf");
+                        } else {
+                            Snprintf(nname, sizeof nname,
+                                     "%sNew_NetHack.cnf", oname);
+                            Snprintf(oname + olen, sizeof(oname) - olen,
+                                     "Old_NetHack.cnf");
+                        }
                     }
 
                     nfp = fopen(nname, "w");
@@ -506,20 +515,19 @@ EditClipping(void)
 char *
 dirname(char *str)
 {
-    char *t, c;
     static char dir[300];
+    char *t;
 
-    t = strrchr(str, '/');
+    strncpy(dir, str, sizeof(dir) - 1);
+    dir[sizeof(dir) - 1] = '\0';
+
+    t = strrchr(dir, '/');
+    if (!t)
+        t = strrchr(dir, ':');
     if (!t)
-        t = strrchr(str, ':');
-    if (!t) {
         dir[0] = '\0';
-    } else {
-        c = *t;
-        *t = 0;
-        strcpy(dir, str);
-        *t = c;
-    }
+    else
+        *t = '\0';
     return (dir);
 }